Mapping ufw rule to iptables

Question

I'm moving from ufw to iptables.

There is a default "limit" rule in ufw, which kicks in if an IP address initiates 6+ connections in 30 seconds (sudo ufw limit ssh). I use that limit rule for SSH traffic (port 22).

I've read so many different ways to do this in iptables, that it's just confusing. I'm unsure whether to use the connlimit or limit or some other module.

What is the simplest way to map this rule 1:1 to iptables?

Answer 1

ufw manipulates on iptables, so since you're moving from ufw, I guess you can capture your iptables and see what ufw does there.

Answer 2

Using the recent extension

Based on @Tomasz's idea, I created the rule in ufw and inspected the result in iptables. Seems ufw uses the recent extension:

:LOG_REJECT - [0:0]

-A INPUT      -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m recent --set
-A INPUT      -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m recent --update --seconds 30 --hitcount 6 -j LOG_REJECT
-A INPUT      -p tcp -m tcp --dport 22                                                                         -j ACCEPT
-A LOG_REJECT                                                     -m limit --limit 3/min                       -j LOG --log-prefix "[LIMITED SSH]"
-A LOG_REJECT                                                                                                  -j REJECT --reject-with icmp-port-unreachable

Using the limit extension

Which is slightly neater/simpler:

:LOG_REJECT - [0:0]

-A INPUT      -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW -m limit --limit 12/minute -j ACCEPT
-A INPUT      -p tcp -m tcp --dport 22 -m conntrack --ctstate NEW                            -j LOG_REJECT
-A LOG_REJECT                                                     -m limit --limit 3/minute  -j LOG --log-prefix "[LIMITED SSH]" --log-level 7
-A LOG_REJECT                                                                                -j REJECT --reject-with icmp-port-unreachable

(Though I'm unsure if icmp-port-unreachable is a proper rejection message in this case.)

Using the connlimit extension

...maybe someone else can add that. :)